Physician Oversight That Holds Up: A Compliance Checklist for Med Spas

Almost every med spa we review already has a medical director on paper. Far fewer have oversight that would actually survive a board review, a payer audit, or a malpractice claim. The gap between the two is almost always documentation — not intent.

Why “We Have a Medical Director” Isn’t Enough

A name on a wall certificate or a signature on a one-page agreement doesn’t establish oversight. Regulators and auditors are looking for evidence that a physician is actively engaged in supervision: reviewing protocols, signing off on delegation, and being reachable for the clinical decisions that require their judgment. Without that evidence, an oversight arrangement that looks fine on the surface can unravel fast under review.

The Checklist

These are the items we walk through with every practice, regardless of state or service mix:

• Written delegation agreement — a document specific to your state that spells out exactly what the physician has delegated to each role (RN, NP, PA, aesthetician) and under what conditions
• Standardized protocols — written, physician-reviewed procedures for every service line you offer, from neurotoxins to IV therapy to weight-loss management
• Good-faith exam (GFE) workflow — a documented process showing every patient is evaluated and cleared by an appropriately licensed provider before treatment, not just before their first visit
• Supervision cadence — a defined schedule or trigger points for physician check-ins, chart reviews, or case consultations, not an open-ended “available if needed”
• Incident and complication protocol — a written plan for adverse events that names who gets called, when, and what happens next
• Recordkeeping — signed protocols, delegation agreements, and supervision logs stored somewhere you could actually produce them on short notice

Where This Usually Breaks Down

The most common gap isn’t a missing document — it’s a stale one. Protocols get written once at launch and never updated as services are added. A GFE workflow exists for injectables but was never extended to a new weight-loss line. A delegation agreement references a physician who left the practice two years ago. None of these are dramatic failures on their own, but stacked together, they’re exactly what an auditor or plaintiff’s attorney looks for.

The paperwork doesn’t need to be perfect. It needs to be current, specific to your state, and something you could hand over today.

Building This Once, Correctly

Every membership tier we offer includes a compliance checklist built for your state and service lines, along with the protocols and delegation documentation to back it up — reviewed and updated as you add services or move into new states. The goal isn’t a binder that sits in a drawer. It’s a live set of documents that reflects how your practice actually runs.

General information only. HOST Medical Consulting, PC is not a law firm and does not provide legal advice; requirements vary by state and by service.